From dc3007acc2774d980e43b9d603bd1198b3c2437a Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 27 Jun 2026 15:50:55 +0000
Subject: [PATCH 1/3] chore(deps): update actions/checkout action to v7

---
 .github/workflows/commit.yml     | 2 +-
 .github/workflows/generate.yml   | 2 +-
 .github/workflows/lint.yml       | 2 +-
 .github/workflows/pre-commit.yml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/commit.yml b/.github/workflows/commit.yml
index 9f61310..0675aa1 100644
--- a/.github/workflows/commit.yml
+++ b/.github/workflows/commit.yml
@@ -11,7 +11,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: 1Password/check-signed-commits-action@v1
 
diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
index 7d2598d..c72d8ab 100644
--- a/.github/workflows/generate.yml
+++ b/.github/workflows/generate.yml
@@ -14,7 +14,7 @@ jobs:
     name: OpenAPI Up-to-date
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ce5cd35..b3c7a9e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: jlumbroso/free-disk-space@v1.3.1
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: setup Go
         uses: actions/setup-go@v6
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index f524517..6fab10b 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -13,7 +13,7 @@ jobs:
     name: Prek Checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:

From deb2c821a9cd437425baa7b86326ccedd6bcfb7f Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Mon, 19 Oct 2026 12:37:09 -0600
Subject: [PATCH 2/3] fix(deps): pin openapi-gen to go.mod kube-openapi version

The "OpenAPI Up-to-date" check installed openapi-gen@latest. Upstream
kube-openapi v0.0.0-20261014 changed generator output (drops `default:`
on array/bool/string items and reflows alignment), so the committed
pkg/openapi/zz_generated.openapi.go no longer matched a fresh generate.

Resolve the generator version from go.mod so CI and `task
generate:openapi` use the same kube-openapi release the spec was
generated with. Regenerating with that pinned version is a no-op
against the committed file.
---
 .github/workflows/generate.yml | 2 +-
 Taskfile.yml                   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
index c72d8ab..b018833 100644
--- a/.github/workflows/generate.yml
+++ b/.github/workflows/generate.yml
@@ -21,7 +21,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Install openapi-gen
-        run: go install k8s.io/kube-openapi/cmd/openapi-gen@latest
+        run: go install "k8s.io/kube-openapi/cmd/openapi-gen@$(go list -m k8s.io/kube-openapi | cut -d' ' -f2)"
 
       - name: Generate OpenAPI
         run: |
diff --git a/Taskfile.yml b/Taskfile.yml
index 4825b93..1c9c0f5 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -4,7 +4,7 @@ tasks:
   generate:openapi:
     desc: Generate OpenAPI definitions from Go types
     cmds:
-      - go install k8s.io/kube-openapi/cmd/openapi-gen@latest
+      - go install "k8s.io/kube-openapi/cmd/openapi-gen@$(go list -m k8s.io/kube-openapi | cut -d' ' -f2)"
       - |
         openapi-gen \
           --output-dir pkg/openapi \

From a24a9006c90705a36be76aade2b3f17dccfc9768 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Mon, 19 Oct 2026 12:51:17 -0600
Subject: [PATCH 3/3] fix(deps): pin goimports to v0.49.0 for go 1.25 CI

golang.org/x/tools v0.50.0+ requires go 1.26, but the CI toolchain comes from go.mod (go 1.25.0). Installing goimports@latest failed the Prek Checks job. v0.49.0 is the newest release whose go directive is <= 1.25.0.
---
 .github/workflows/pre-commit.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 6fab10b..eb3a65b 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -24,6 +24,6 @@ jobs:
           version: latest
           install-only: true
 
-      - run: go install golang.org/x/tools/cmd/goimports@latest
+      - run: go install golang.org/x/tools/cmd/goimports@v0.49.0
 
       - uses: j178/prek-action@v2